A clear account of how website data is intended to be handled.

1. Scope and identity

This draft applies to the HiqmaHub marketing website at hiqmahub.com and its project enquiry flow. The service is currently identified publicly as HiqmaHub. A confirmed legal business name and address have not been supplied and must be added before this notice is approved for production.

2. Information the enquiry form is designed to collect

If you choose to submit a project enquiry, the form requires your name, either an email address or phone/WhatsApp number, a service interest, a project message, and privacy acknowledgement. You may also provide the other contact channel, company, website, budget band, and timeline. The lead record includes a consent timestamp and the form path. Five bounded campaign parameters may be retained with the lead only when analytics consent has been given; query strings and form contents are never sent as analytics event values.

Cloudflare Turnstile processes a short-lived security token for spam screening. The server also converts a request network address into a secret-keyed one-way rate-limit value. It does not store the raw address in the lead record or rate-limit table; counters older than 24 hours are removed when a later submission performs the next rate-limit check.

3. Why that information is used

The intended uses are limited to:

• reviewing and responding to a project enquiry;
• qualifying the requested scope and arranging follow-up;
• protecting the form from spam and automated abuse;
• maintaining an operational record of the enquiry; and
• understanding website performance and conversion only where the required analytics consent has been given.

Final lawful bases for each purpose must be confirmed during legal review for the regions in which HiqmaHub operates.

4. Planned service providers

The repository implementation uses Supabase for durable lead and notification-task storage, Resend for internal enquiry notifications and email acknowledgements, and Cloudflare Turnstile for form abuse prevention. An email acknowledgement is queued only when email is the selected contact method. Vercel is configured for website hosting. Google Analytics is the sole product-event owner and loads only after analytics consent when a valid measurement property is configured; advertising storage and advertising signals remain disabled.

These providers may process data in other countries under their own contractual and transfer safeguards. The production vendor list, agreements, locations, and links to provider notices must be verified before launch.

5. Cookies and analytics

Essential technologies may be used to deliver and protect the website. Optional analytics remains disabled until the relevant consent choice has been made. Work views, service selections, form starts, accepted leads, and email, telephone, or WhatsApp clicks use a bounded event vocabulary. Names, contact details, company names, websites, budgets, timelines, messages, receipt references, and submission identifiers are not event parameters. Where analytics is configured, the footer provides an Analytics choices control so the decision can be revisited.

6. Retention and security

Database permissions restrict enquiry and delivery records from browser roles; the application uses a server-side Supabase credential. Delivery tasks use bounded retry attempts and record non-personal error codes. A final lead-retention schedule, deletion routine, incident process, monitoring owner, and access-review cadence are launch inputs and are not yet stated in this draft.

7. Tools

The five utility routes currently provide informational landing pages only. They do not yet accept or process documents, text, URLs, or passwords. Their planned browser-based privacy model will need a separate technical and privacy review when each tool becomes functional.

8. Your choices and requests

Depending on where you live, you may have rights to ask about, access, correct, delete, restrict, or object to certain uses of your personal information. The final notice must explain the applicable process and any identity checks. For now, privacy questions can be sent to hiqmahubcom@gmail.com.

9. Changes to this notice

The approved notice should show an effective date and be updated when the website's data practices or service providers change. Material changes should be communicated in a proportionate way.